1. Technical Field
This disclosure generally relates to computer systems, and more specifically relates to verification of computer programs in computer systems.
2. Background Art
Computer programs have been distributed for some time on recordable media, such as floppy disk or CD-ROM. In recent times, the internet has become a valuable tool in distributing computer programs. One significant advantage of downloading computer programs via the internet is the programs are available immediately. No more must a person go to a store, browse through the boxes of computer programs on a shelf, select the one of interest, purchase the computer program, then return home to install the computer program. Instead the person may browse to a web site that offers the computer program, pay via credit card, and download the computer program immediately after the purchase.
Many computer programs now offer online updates via the internet. A person's computer may periodically check a website for updates to a specific computer program, and when an update is found, the update may be automatically downloaded. Because so many people and companies rely upon computers for both business and pleasure, it is essential to verify a computer program is valid before it is installed. Digital signatures have been used to verify the validity of computer programs. A digital signature is a unique identifier that is generated using public key/private key encryption techniques over specified data. For a computer program, a digital signature may be created for invariant data, which is data in the computer program that does not change. Many computer programs include calls external to the computer program, such as to program libraries or operating system calls. Because the target of external calls are not known by the computer program at compile time, external calls are considered variant data, and typically are excluded from the data covered by the digital signature. As a result, external calls provide a point of vulnerability for a computer program. A hacker could potentially hack an external call reference to call the hacker's code, and the calling program might never know it has called unauthorized code. Without a way to validate computer programs that contain external call references, such programs will remain vulnerable to attacks by hackers.